Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
82
65
21
5
5
Contributors
32
28
21
20
10
Categories
62
58
53
43
38
Platforms
104
68
17
13
9
Products / Services
80
47
41
16
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
43
27
4
4
1
IDS Protocols
55
13
12
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (dotauan .pro)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (polimakels .com)
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
This rule correlates Microsoft Defender for Endpoint (MDE) SmartScreen and Network Protection blocks with network activity logs. It specifically looks for instances where SmartScreenUrlWarning or ExploitGuardNetworkProtectionBlocked events occur due to 'CustomBlockList' or 'CustomPolicy' settings. The rule then joins these events with DeviceNetworkEvents to identify the associated URLs, remote IP addresses, and ports involved in the blocked network communication. The primary goal is to identify and provide context for network access attempts that are blocked by custom security policies, indicating potential malicious or unwanted website access.
This rule detects suspicious ad click traffic that routes through Google Ad Services It specifically looks for URLs containing Google Click Identifier (gclid), an ad URL, and a placement ID, while excluding legitimate ad routing services. This could indicate ad fraud or malvertising.
Most but not all clicks on Google ads are routed this way.
Most but not all clicks on Google ads are routed this way.
Detects Windows Management Instrumentation Command-line (WMIC) execution from browsers, often used in ClickFix attacks for remote process creation or system manipulation.
This rule detects instances where common web browsers (e.g., Chrome, Edge, Firefox) launch specific Living Off The Land Binaries (LOLBins) or scripting interpreters. The LOLBins and interpreters include `cmd.exe`, `powershell.exe`, `rundll32.exe`, `regsvr32.exe`, `msiexec.exe`, `mshta.exe`, `hh.exe`, `certutil.exe`, and `bitsadmin.exe`. This activity can indicate malicious intent, such as drive-by downloads, exploit kit activity, or initial access attempts where an attacker leverages a browser to execute system utilities for further compromise.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Detecting Phishing Emails with Cloudflare R2 URLs
KQL Query
KQL Query from file: MDO Email Threat Classification By Country
Page 8 of 9